emotet | b14b79746d5fdb7bc3761e79d25eeccc38b63a8776b5af5c7f6b53ac25a92b56

Analysis

Target
triage_dropped_file.dll
Size 573KB
Sample220314-n6weaaggfm
SHA256 b14b79746d5fdb7bc3761e79d25eeccc38b63a8776b5af5c7f6b53ac25a92b56
MD5 3a6f24c351cf6d15e1dce3669e522edc
SHA1 eb83e25bda04913ce4942f4cfb5e18837e46b865
SHA512 cd2881c09cc0cbcd4c720bf525fb190be284ef8cbd58f87748cb87024f4201ab5ebcdc73170ae550e61205c03ef29681adef4b0385bab7444aa4006eefee9901
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4140	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qyfznxtgzibgjkv\matgc.pbi	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4140	regsvr32.exe
4140	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5108	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 5108	4824	regsvr32.exe	82
PID 4824 wrote to memory of 5108	4824	regsvr32.exe	82
PID 4824 wrote to memory of 5108	4824	regsvr32.exe	82
PID 5108 wrote to memory of 4140	5108	regsvr32.exe	88
PID 5108 wrote to memory of 4140	5108	regsvr32.exe	88
PID 5108 wrote to memory of 4140	5108	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Qyfznxtgzibgjkv\matgc.pbi"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4140

memory/5108-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download